Subject: [drinks] Questions about spprov-9 6.2 GetDestGrpsRqst

From: Dean Willis <[email-masked]>
Date: Tue, 16 Aug 2011 17:30:11 -0500

From the text:

6.2.  Get Destination Groups Operation

   The getDestGrpsRqst operation allows an SPPP client to get the
   properties of Destination Group objects that a registrar is
   authorized to view on behalf of the registrant.  The server will
   attempt to find a Destination Group object that has the registrant ID
   and destination group name pair contained in each ObjKeyType object
   instance.  If there are no matching Destination Groups found then an
   empty result set will be returned.  If no ObjKeyType objects are
   found in the request then the server will return the list of all
   Destination Group objects in the registry.  If no matching records
   can be located then an empty result set will be returned.

1) The first line of the para refers to "getDestGrpsRqst", but the XML schema has it as "GetDestGrpsRqst". Which is right?  The OpenSPP implementation goes with the schema right now.

2) I (and our server implementation) seem to find the "If no ObjKeyType objects are found in the request then the server will return the list of all Destination Group objects in the registry" part confusing.

The auth model is based on the Registrant ID, aka "rant". But ObjKeyType holds "rant" and "name". So if there's no objKey, we don't know which registrant to look for.  Note that earlier text says "that a registrar is authorized to view on the behalf of the registrant". So, where's there's no specified registrant, which records is the registrar entitled to see?

I suspect the answer is "It's outside of the protocol specification", which I find unsatisfying. Right now, OpenSPP returns a null list of there's no objKey in the request. And frankly, we've got no auth model, and pretty much assume anybody can see anything. But if we were authenticating requester against the request's rant, we still wouldn't know how to respond to a null query.

3) Note that I find the whole "registrar" thing confusing. Can't we just say "client"? You don't KNOW that the thing making SOAP calls is a registrar. It might be, for example, a maintenance tool used by a sysop. But you do know it's a client...